This depends a lot on the context.
Normally, I would say that the form should be in a plugin.
The rule of thumbs is that if it’s a functionality that could still be needed when the theme is deactivated, then it should go into a plugin.
Now for your specific case, if using the customizer, would set options that could potentially break your form if the theme should be changed, then you should keep it in your theme’s functions.php.
But, I would still argue that it should go into a plugin and you should make sure that, in the eventuality that the theme is changed, you set default values to the form to replace the customizer options.
Because chances are that even if the theme is changed, you’d still want the contact form to be active.